Open Bug 1715285 Opened 3 years ago Updated 2 years ago

Crash in [@ style::traversal::compute_style<T>]

Categories

(Core :: CSS Parsing and Computation, defect)

All
Windows
defect

Tracking

()

Tracking Status
firefox-esr78 --- affected
firefox89 --- affected
firefox90 --- affected
firefox91 --- affected

People

(Reporter: aryx, Unassigned)

References

Details

(Keywords: crash)

Crash Data

300-600 crash reports stored per release cycle, all on Windows, ~60% with x86_64 builds and ~40% with x86.

Crash report: https://crash-stats.mozilla.org/report/index/a9f1a2c6-aae4-4e21-9126-bfbb60210608

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll style::traversal::compute_style<style::gecko::wrapper::GeckoElement> servo/components/style/traversal.rs:675
1 xul.dll style::parallel::traverse_nodes<style::gecko::wrapper::GeckoElement, style::gecko::traversal::RecalcStyleOnly, smallvec::Drain<[style::dom::SendNode<style::gecko::wrapper::GeckoNode>; 128]>> servo/components/style/parallel.rs:277
2 xul.dll style::parallel::traverse_nodes<style::gecko::wrapper::GeckoElement, style::gecko::traversal::RecalcStyleOnly, smallvec::Drain<[style::dom::SendNode<style::gecko::wrapper::GeckoNode>; 128]>> servo/components/style/parallel.rs:289
3 xul.dll rayon_core::job::{{impl}}::execute<closure-0> third_party/rust/rayon-core/src/job.rs:167
4 xul.dll rayon_core::registry::WorkerThread::wait_until_cold third_party/rust/rayon-core/src/registry.rs:731
5 xul.dll rayon_core::scope::ScopeBase::steal_till_jobs_complete third_party/rust/rayon-core/src/scope/mod.rs:596
6 xul.dll rayon_core::scope::scope_fifo::{{closure}}<closure-0, tuple<>> third_party/rust/rayon-core/src/scope/mod.rs:384
7 xul.dll rayon_core::job::{{impl}}::execute<rayon_core::latch::LockLatch*, closure-0, tuple<>> third_party/rust/rayon-core/src/job.rs:119
8 xul.dll rayon_core::registry::WorkerThread::wait_until_cold third_party/rust/rayon-core/src/registry.rs:731
9 xul.dll std::sys_common::backtrace::__rust_begin_short_backtrace<closure-0, tuple<>> ../88f19c6dab716c6281af7602e30f413e809c5974/library/std/src/sys_common/backtrace.rs:125
Severity: -- → S2
See Also: → 1716028
See Also: → CVE-2021-32810

(In reply to Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout) from comment #0)

300-600 crash reports stored per release cycle, all on Windows, ~60% with x86_64 builds and ~40% with x86.

Seems like volume has gone down a bit? Only seeing a few crashes in version 106 (current release).

Maybe this crash has been fixed or has moved, and the remaining crashes are just memory corruption or one-off weirdness?

Downgrading to S3, given that this seems to mostly or entirely gone away.

I still see only 2 crashes in 106, and none in any newer version. Possibly the signature changed here (I think we enabled inline functions to be included in the crash signature in 106 or thereabouts).

Severity: S2 → S3
You need to log in before you can comment on or make changes to this bug.